SDL Deliverables

Product risk profile (Deliverable for SDL Phase)

A1

SDL project outline (Deliverable for SDL Phase)

A1

Applicable laws and regulations (Deliverable for SDL Phase)

A1

Threat profile (Deliverable for SDL Phase)

A1

Certification requirements (Deliverable for SDL Phase)

A1

List of third-party software (Deliverable for SDL Phase)

A1

Metrics template (Deliverable for SDL Phase)

A1

Business requirements (Deliverable for SDL Phase)

A2

Threat modeling artifacts (Deliverable for SDL Phase)

A2

Architecture threat analysis (Deliverable for SDL Phase)

A2

Risk mitigation plan (Deliverable for SDL Phase)

A2

Policy compliance analysis, not "updated" (Deliverable for SDL Phase)

A2

Updated threat modeling artifacts (Deliverable for SDL Phase)

A3

Design security review (Deliverable for SDL Phase)

A3

Security test plans (Deliverable for SDL Phase)

A3

Privacy implementation assessment results (Deliverable for SDL Phase)

A3

Updated policy compliance analysis (Deliverable for which 3 SDL Phases)

A3, A4, A5

Security test execution report (Deliverable for SDL Phase)

A4

Privacy compliance report (Deliverable for SDL Phase)

A4

Security testing reports (Deliverable for 2 PHASES)

A4, A5

Remediation report (Deliverable for which TWO SDL Phases)

A4, A5

Open-source licensing review report (Deliverable for SDL Phase)

A5

Final security and privacy review reports (Deliverable for SDL Phase)

A5

Customer engagement framework (Deliverable for SDL Phase)

A5

External vulnerability disclosure response process (Deliverable for SDL Phase)

PRSA

Post-release certifications (Deliverable for SDL Phase)

PRSA

Third-party security reviews (Deliverable for SDL Phase)

PRSA

Security strategy and process for legacy code, M&A, and EOL plans (Deliverable for SDL Phase)

PRSA

Estimate actual cost of the product (Goal of which Deliverable)

Product risk profile

Map SDL activities to the development schedule (Goal of which Deliverable)

SDL project outline

Guide SDL activities to mitigate threats; input to threat modeling (Goal of which Deliverable)

Threat profile

Identify dependence on third-party software (Goal of which Deliverable)

List of third-party software